CVE-2026-82627 | High | 7.5 | 2026-10-08 | The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Inje… |
CVE-2026-95606 | Critical | 9.8 | 2026-10-07 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.
This issue affects The Events Calendar… |
CVE-2026-95534 | High | 8.8 | 2026-10-07 | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injectio… |
CVE-2026-106558 | High | 8.8 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly valid… |
CVE-2026-105192 | Critical | 9.8 | 2026-10-07 | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Mes… |
CVE-2026-107104 | | | 2026-10-07 | This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote atta… |
CVE-2025-64393 | | | 2026-10-07 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. |
CVE-2026-97188 | High | 8.8 | 2026-10-07 | The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its datab… |
CVE-2026-93447 | High | 7.5 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache va… |
CVE-2026-65142 | High | 7.8 | 2026-10-06 | NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might… |
CVE-2026-76750 | Critical | 9.8 | 2026-10-06 | Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an… |
CVE-2026-103831 | | | 2026-10-06 | CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native un… |
CVE-2026-39797 | Critical | 9.8 | 2026-10-06 | Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions. |
CVE-2026-104747 | High | 8.1 | 2026-10-06 | Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. |
CVE-2026-82988 | High | 7.5 | 2026-10-06 | There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unp… |
CVE-2026-97257 | High | 8.8 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Even… |
CVE-2026-93617 | High | 7.2 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Phot… |
CVE-2026-103348 | High | 7.2 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ult… |
CVE-2026-100511 | High | 8.8 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue a… |
CVE-2026-100506 | High | 7.2 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from… |
CVE-2026-97283 | Critical | 9.8 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affect… |
CVE-2026-103349 | High | 7.2 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affec… |
CVE-2026-104905 | High | 8.1 | 2026-10-05 | FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to tr… |
CVE-2026-37719 | Critical | 9.8 | 2026-10-05 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. |
CVE-2019-25777 | High | 7.3 | 2026-10-05 | YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.
A perl/g… |
CVE-2017-20285 | Critical | 9.1 | 2026-10-05 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the c… |
CVE-2026-103877 | Critical | 9.8 | 2026-10-02 | Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.
A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSc… |
CVE-2026-55083 | Critical | 9.1 | 2026-10-01 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from… |
CVE-2026-12544 | High | 7.7 | 2026-10-01 | A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configurat… |
CVE-2026-97284 | High | 8.8 | 2026-10-01 | Contributor PHP Object Injection in Icegram <= 3.1.31 versions. |
CVE-2026-94390 | High | 7.2 | 2026-10-01 | Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions. |
CVE-2026-102135 | Medium | 6.6 | 2026-09-30 | On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that… |
CVE-2026-102108 | High | 7.2 | 2026-09-30 | An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deseri… |
CVE-2026-102101 | High | 8.1 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain condi… |
CVE-2026-97291 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions. |
CVE-2026-97256 | High | 7.2 | 2026-09-30 | Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. |
CVE-2026-102392 | High | 7.2 | 2026-09-30 | Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions. |
CVE-2026-102377 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. |
CVE-2026-100512 | Critical | 9.8 | 2026-09-30 | Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions. |
CVE-2026-103441 | | | 2026-09-30 | Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable File… |
CVE-2026-103395 | Critical | 9.8 | 2026-09-30 | LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments i… |
CVE-2026-97248 | Critical | 9.8 | 2026-09-30 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
CVE-2026-97246 | Medium | 4.9 | 2026-09-30 | Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions. |
CVE-2026-96833 | High | 7.2 | 2026-09-30 | Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. |
CVE-2026-96832 | High | 7.2 | 2026-09-30 | Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
CVE-2026-96831 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. |
CVE-2026-96344 | High | 7.2 | 2026-09-30 | Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. |
CVE-2026-96343 | High | 7.2 | 2026-09-30 | Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. |
CVE-2026-95531 | High | 8.8 | 2026-09-30 | Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. |
CVE-2026-94683 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. |
CVE-2026-94678 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. |
CVE-2026-94677 | High | 7.2 | 2026-09-30 | Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. |
CVE-2026-94122 | High | 7.2 | 2026-09-30 | Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. |
CVE-2026-94121 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. |
CVE-2026-94076 | High | 8.8 | 2026-09-30 | Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions. |
CVE-2026-93771 | High | 7.2 | 2026-09-30 | Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions. |
CVE-2026-93651 | High | 7.2 | 2026-09-30 | Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions. |
CVE-2026-93624 | High | 7.2 | 2026-09-30 | Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions. |
CVE-2026-102455 | Critical | 9.8 | 2026-09-30 | EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by s… |
CVE-2026-91051 | Medium | 6.6 | 2026-09-30 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a… |
CVE-2026-13046 | | | 2026-09-30 | A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already o… |
CVE-2026-103041 | Critical | 9.8 | 2026-09-29 | LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can… |
CVE-2026-103040 | Critical | 9.8 | 2026-09-29 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exp… |
CVE-2026-100308 | High | 7.8 | 2026-09-29 | Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary o… |
CVE-2026-101169 | | | 2026-09-29 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for… |
CVE-2026-81867 | | | 2026-09-28 | A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud P… |
CVE-2026-82384 | Critical | 9.8 | 2026-09-28 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, becau… |
CVE-2026-86841 | Medium | 4.7 | 2026-09-27 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly r… |
CVE-2026-100846 | High | 7.6 | 2026-09-27 | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads… |
CVE-2026-100845 | High | 7.8 | 2026-09-27 | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when l… |
CVE-2026-100843 | High | 7.8 | 2026-09-27 | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in mo… |
CVE-2026-100841 | High | 7.8 | 2026-09-27 | In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache Me… |
CVE-2026-97869 | Medium | 4.1 | 2026-09-25 | A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson o… |
CVE-2026-84862 | High | 7.2 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerab… |
CVE-2026-97865 | High | 7.3 | 2026-09-25 | A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Rem… |
CVE-2026-96745 | Medium | 5.6 | 2026-09-24 | Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored… |
CVE-2026-63630 | Low | 3.4 | 2026-09-24 | BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from impor… |
CVE-2026-82093 | High | 8.8 | 2026-09-24 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted da… |
CVE-2026-80513 | High | 7.5 | 2026-09-24 | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, al… |
CVE-2026-95603 | High | 7.2 | 2026-09-23 | Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. |
CVE-2026-96804 | High | 8.8 | 2026-09-23 | MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which all… |
CVE-2026-96775 | High | 8.8 | 2026-09-23 | MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which all… |
CVE-2026-18490 | High | 8.8 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayD… |
CVE-2026-96560 | Critical | 9.8 | 2026-09-23 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauth… |
CVE-2026-95928 | Medium | 5.5 | 2026-09-23 | A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsre… |
CVE-2026-95897 | Medium | 5.5 | 2026-09-23 | A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loa… |
CVE-2026-18163 | Critical | 9.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrust… |
CVE-2026-17637 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untru… |
CVE-2026-67615 | High | 8.8 | 2026-09-22 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary cod… |
CVE-2026-28325 | High | 8.8 | 2026-09-22 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrus… |
CVE-2026-43642 | High | 8.1 | 2026-09-22 | Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticate… |
CVE-2026-83803 | | | 2026-09-22 | Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deseriali… |
CVE-2026-83603 | High | 8.4 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsu… |
CVE-2026-95806 | | | 2026-09-22 | MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a p… |
CVE-2026-93088 | Critical | 9.8 | 2026-09-22 | SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionSe… |
CVE-2026-65179 | High | 8.8 | 2026-09-22 | NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without… |
CVE-2026-65178 | High | 7.8 | 2026-09-22 | NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful e… |
CVE-2026-24267 | High | 7.8 | 2026-09-22 | NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause re… |
CVE-2026-24239 | High | 7.8 | 2026-09-22 | NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful explo… |
CVE-2026-91827 | High | 7.5 | 2026-09-22 | The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form subm… |